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Listing of Claims 

1 . (Currently amended) A method of tracing data traffic on a network, the 
method comprising: 

at the transport layer of a protocol stack residing on a first device in the network, 
detecting , upon the occurrence on an event, a transmission or receipt of data to or from a 
second device on the network as a transport control block entry related to the event, the event 
comprising: 

a send complete event, a receive indicate event, or a receive complete event ; 

and 

in response to the transmission or receipt being detected, recording copying the 
transport control block entry related to the event from the transport control block t he 
transmission or rec e ipt as an e ntry in to a trace log[[ J]i 

wherein the trace log is accessible to determine the volume of data traveling over a 
network. 

2. (Original) The method of claim 1, wherein the protocol stack is a TCP/IP 

stack. 

3. (Currently Amended) The method of claim 1 , wh e r e in the d e tection st e p 
further comprises comprising th e st e p of detecting the presence of an input/output packet 
representing the transmission or receipt. 

4. (Currently Amended) A method of tracing a data transmission of data over a 
computer network comprising: 

detecting a transport-layer request to transmit an input/output pack e t the data 
transmission in a transport control block : 

searching the input/output pack e t data transmission to determine an identity of a 
process that created the input/output pack e t data transmission : and 

storing in a trace log [[an]] a first entry representing the transport-layer request to 
transmit the data transmission ^,]]; 
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detecting an acknowledgment of the data transmission in a transport control block; 
storing in the trace log a second entry representing the acknowledgment of the data 
transmission; 

detecting a transport-layer reception of the data transmission in the transport control 

block; 

storing in the trace log a third entry representing receiving the data transmission; 
detecting a transport-layer completion of the data transmission in the transport control 

block; 

storing in the trace log a fourth entry representing the completion of the data 
transmission; 

wherein the first entry comprises the identity of the process[[,]]; and 
wherein the trace log is accessible to determine a volume of data being transmitted 
over the network. 

5. (Canceled) 

6. (Canceled) 



7. 



(Canceled) 



8. 



(Canceled) 



9. 



(Canceled) 



10. 



(Canceled) 



11. 



(Canceled) 



12. 



(Canceled) 



13. 



(Canceled) 
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14. (Canceled) 

15. (Currently amended) A computer-readable medium having stored thereon 
computer-executable instructions for tracing data traffic on a network p e rforming st e ps 
comprising: 

detecting a transport-layer request to transmit an input/output pack e t a data 
transmission to a port connection ; 

searching the input/output packet data transmission to determine an identity of a 
process that created the input/output pack e t the data transmission ; and 

storing in a trace log [[an]] a first entry representing the transport-layer request to 
transmit the data transmission ^,]]; 

detecting an acknowledgment of the data transmission in the transport control block; 

storing in the trace log a second entry representing the acknowledgment of the data 
transmission; 

detecting a transport-layer reception of the data transmission in the transport control 

block; 

storing in the trace log a third entry representing receiving the data transmission; 
detecting a transport-layer completion of the data transmission in the transport control 

block; 

storing in the trace log a fourth entry representing the completion of the data 
transmission; 

wherein the first entry comprises the identity of the process[[,]]; and 
wherein the trace log is accessible to determine a volume of data being transmitted 
over the network. 

16. (Canceled) 

17. (Canceled) 



18. (Canceled) 
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19. (Currently Amended) The computer-readable medium of claim [[181115, 
having further computer-executable instructions comprising: 

opening the port connection by the process; 

creating a connection object representing the opening of the port connection by the 
process; 

copying the process identification from the connection object into a transport control 
block associated with the port; and 

in response to the detection of the receipt of data at the port connection , copying the 
process identification into the trace log from the transport control block . 

20. (Canceled) 

21. (Canceled) 

22. (Previously Presented) The method of claim 1, wherein the transmission of 
data is recorded at the completion of the transmission indicated by an acknowledgment from 
the first device. 

23. (Canceled) 

24. (Previously Presented) The method of claim 4, wherein the identity of the 
process includes a port number or an IP address relating to the transmission. 

25. (New) The method of claim 1, wherein the entry related to the event 
comprises at least one of a source address, a destination address, a source port number, a 
destination port number, a number of bytes transmitted, a size of the data received, a process 
identification, an entry time, or a transmission time. 

26. (New) The method of claim 1, wherein the send complete event occurs when 
the first device receives an acknowledgement for a last byte of the transmission from the 
second device. 
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27. (New) The method of claim 1, wherein the receive indicate event occurs when 
the protocol stack receives an input/output request packet through an interface. 

28. (New) The method of claim 1, wherein the receive complete event occurs 
when a request for data is completed. 

29. (New) The method of claim 4, wherein the acknowledgement of the data 
transmission is detected when the last byte of the transport-layer request to transmit the data 
transmission is received. 

30. (New) The method of claim 4, wherein the transport-layer reception of the 
data transmission is detected when the transport layer receives the data transmission through an 
interface. 

31. (New) The method of claim 4, wherein the transport-layer completion of the 
data transmission is detected when the request to transmit the data transmission is completed. 

32. (New) The method of claim 4, wherein the first, second, third, and fourth 
entries comprise at least one parameter related to the data transmission, the at least one 
parameter related to the data transmission comprising a source address, a destination address, a 
source port number, a destination port number, a number of bytes transmitted, a size of the data 
received, a process identification, an entry time, or a transmission time. 

33. (New) The computer-readable medium of claim 1 5, wherein the 
acknowledgement of the data transmission is detected when the last byte of the transport-layer 
request to transmit the data transmission to the port is received. 

34. (New) The computer-readable medium of claim 1 5, wherein the transport- 
layer reception of the data transmission is detected when the transport layer receives the data 
transmission through an interface. 
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35. (New) The computer-readable medium of claim 1 5, wherein the transport- 
layer completion of the data transmission is detected when the request to transmit the data 
transmission to the port is completed. 

36. (New) The computer-readable medium of claim 15, wherein the first, second, 
third, and fourth entries comprise at least one parameter related to the data transmission, the at 
least one parameter related to the data transmission comprising a source address, a destination 
address, a source port number, a destination port number, a number of bytes transmitted, a size 
of the data received, a process identification, an entry time, or a transmission time. 

37. (New) A computer system comprising: 
a network; 

a first computing device configured to send a transmission across the network to a 
second computing device; 

a transport protocol stack residing on the first computing device configured to receive 
the transmission; 

a transport control block communicating with the transport protocol stack, the 
transport control block configured to store at least one transport control block entry, the at 
least one transport control block entry comprising at least one transmission parameter; and 

a trace logger comprising a trace log; 

wherein the trace logger is configured to copy the at least one transmission parameter 
to the trace log from the transport control block, the at least one transmission parameter 
comprising information related to at least one of a send complete event, a receive indicate 
event, or a receive complete event; and 

wherein the trace log is accessible to determine a volume of data being transmitted 
over the network. 

38. (New) The system of claim 37, wherein the at least one transmission 
parameter comprises at least one of a source address, a destination address, a source port 
number, a destination port number, a number of bytes transmitted, a size of the data received, a 
process identification, an entry time, or a transmission time. 
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39. (New) The system of claim 37, wherein the send complete event occurs when 
the first device receives an acknowledgement for a last byte of the transmission from the 
second device. 

40. (New) The system of claim 37, wherein the receive indicate event occurs 
when the protocol stack receives an input/output request packet through an interface. 

41. (New) The system of claim 37, wherein the receive complete event occurs 
when a request for data is completed. 



